Cisco steps up fix for critical DNA Center flaw

Cisco has offered users a second method to combat a critical vulnerability in its DNA Center network management software.

DNA Centre is the key management tools for Cisco-powered networks, and is advanced as the key element of the company’s intent-based networking push. DNA Centre is also suggested as the tool for MSPs or system integrators to use when managing their clients’ networks.

Which makes the bug – a CVSS 9.3-rated nasty that “could allow an unauthenticated, adjacent attacker to bypass authentication and access critical internal services” on June 19^th, 2019.

“The vulnerability is due to insufficient access restriction to ports necessary for system operation,” the advisory explains. “An attacker could exploit this vulnerability by connecting an unauthorized network device to the subnet designated for cluster services. A successful exploit could allow an attacker to reach internal services that are not hardened for external access.”

Which makes it just the sort of thing that users will want to fix sooner rather than later.

But the initial bug announcement offered just simple path to fix it: upgrade to version 1.3 of the product, which was released on just May 30^th, 2019. DNA Center, which ships as a dedicated appliance, offers a system update option that downloads the new version from Cisco’s cloud and can require update of both the appliance and other Cisco applications. Moving to version 1.3 also requires that users have already adopted either version 1.2.8 or 1.2.10.

All of which adds up to just the sort of job that users – be they enterprise or service providers - will often find onerous.

Which is why Cisco’s June 27^th update to its initial advisory will be welcome, as it offers a workaround other than an upgrade.

But there’s still work to do: Cisco’s upgraded advice says that implementing the workaround requires a chat with its Technical Assistance Center.

There’s some tiny upside in this mess: Cisco found the bug itself, and there’s no indication it’s been exploited.